feat(graph): add type hierarchy analysis

[balcsida]

Summary

Adds S1.06b1 of the CodeGraph parity roadmap: type relations and type hierarchy analysis over stored v2 CodeGraph facts. This is service-level only (graphquery.Service and the authorizing graphservice.Service). No REST, MCP, or browser surface changes; those belong to S1.07/S1.09.

• TypeRelations: recorded outgoing type_of/returns, incoming type users and returners, referenced types, and recorded overrides. Every original edge occurrence is kept. type_knowledge=unknown when the producer recorded no type facts.
• TypeHierarchy: extends/implements ancestors (depth 8) and breadth-first descendants (depth 6, 400 rows; the viewer shows 24/240 with total/shown/truncated). Cycles and duplicate edges are visited once. When a bound stops the walk, bounded, partial, boundaries and hidden_subtypes say so. Go implicit implementations keep their synthesized metadata. Name-matched derived overrides are always signature_uncertain and are kept separate from recorded overrides.
• PostgreSQL CountHierarchyChildren: counts distinct direct subtypes and implementers in one query scoped to repository, upload, commit and schema, so the counts stay true when the list is truncated. A subtype linked by both relations counts once, as extends.
• EntityNeighbors internal limit raised from 101 to 401, so the 400-row walk can see one row past its limit.

Evidence

The expected answers come from the pinned CodeGraph b9ca4b7981116909900368cc1686a1074cd4d4c1:

• test/fixtures/codegraph/type-hierarchy-facts.json: complete real-producer capture (37 nodes, 53 edges, 3 files, 5 unresolved references) with its four source files. The integration test checks their hashes.
• The existing library fixture's Base/Service hierarchy and the Base.greet derived override.
• Synthetic topologies cover direction, bounds, cycles and cancellation. They are labelled as synthetic, not producer output.

Known differences from upstream

Both are documented in docs/graph-analysis.md:

• Level ordering compares names by byte order; upstream uses localeCompare.
• A subtype with both extends and implements counts as extends; upstream counts it by whichever edge it reads first.

Compatibility and security

• No schema or migration change. No new dependency.
• Existing authorization and selected-generation checks apply before and after each query.
• The limit increase affects only the internal neighbor query.

Verification

GOWORK=off go vet ./... && GOWORK=off go vet -tags=integration ./...
GOWORK=off go test -race ./internal/graphprotocol ./internal/graphquery ./internal/graphservice ./internal/postgres
make postgres-test   # run with -race: postgres, authz, webhook, integration, indexer, server (586 passed)
make staticcheck

Remaining S1.06 work

B2 dead-code candidates, flows, routes, screens and steps, and coverage of all thirteen source languages. The full Stage 1 gate has not been run, and this PR does not claim it passes.

🤖 Generated with Claude Code